feat: the mutating half — chart automation, connections connect/disconnect, dialog/strategy/playbackctl/log, layout

[silentsudo-io]

Thanks for merging #2 and #4 — this builds on both.

This is the mutating half of the bridge, plus the chart automation it enables. It is big, so the
sections below are independent enough to review (or reject) one at a time, and I'm happy to split it
into separate PRs if you'd prefer — I kept it as one because this is the exact tree that has been
compiled and driven against a live NinjaTrader. Splitting it would mean sending you configurations I
have not actually run.

Everything here was verified by driving it, not by the call returning. That distinction is the
theme of the whole diff.

---

1. chart — list / add / remove / close, and --api discovery

--api is read-only and dumps what this build actually exposes (BarsProperties, Bars,
BarsPeriod, ChartBars methods, the Connection API). It earns its place immediately — it refuted
two assumptions before they became bugs:

• Bars.IsResetOnNewTradingDay is read-only.
• "Break at EOD" is settable nowhere: absent from BarsProperties, absent from BarsPeriod
  (unfiltered dump), read-only on Bars, absent from every chart template. A setter written against
  the obvious name would have resolved, changed nothing, and reported success.

2. chart --apply-template — indicators that actually run

The existing addIndicator path cannot bring an indicator to life: Indicators.Add +
SetState(Active) + RefreshIndicators leaves it at Configure, and the best advice it can give is
"re-add it from the UI." This hands NT the XML it wrote via TemplateLoadIndicators, so NT's own
loader runs the state machine.

Result on a bare chart: 0 → 14 indicators, all 14 at Realtime.

Three things it measures rather than assumes:

• Which XElement? TemplateLoadIndicators(<Indicators>) works; the same method given the document
  root "resolved but count stayed 0". Candidates are tried and the winner is reported as via, so a
  silent no-op cannot read as success.
• ⚠ RefreshAllBars REGRESSES indicators to 0 running. Found by laddering each step separately:
  ApplyNinjaScripts → 2 running, RefreshIndicators(true,true) → 3, then RefreshAllBars → 0.
  It is excluded here. Heads-up: addIndicator still calls it as a fallback, so that path is
  suspect for the same reason — I have not changed it in this PR.
• Activation is asynchronous. Indicators climb SetDefaults → Configure → DataLoaded → Historical → Realtime as bars load. Counting once, immediately, read 3 of 14 and would have reported a
  healthy chart as broken. It now settle-polls, the same way playbackctl --seek does.

3. chart --data-window

RangeType / DaysBack / BarsBack / MonthsBack / From / To — all [RW] (measured on two
builds). ChartBars exposes no reload of its own, so the apply is Chart.OnDataSeriesChanged, then it
settles on IsBarsLoading and reads every field back.

• Only fields the caller named are sent, and only those move — no silent side effects.
• A rejected field fails the whole call (succeeded=false, rejectedFields=N, CLI exit 2). The
  first version returned success while silently dropping an unparseable date, which a script would
  never have noticed. That bug is in the history on purpose.
• Dates parse culture-invariantly: a window that means one thing on a US box and another on an EU
  box is a silently different backtest.

4. connections --connect / --disconnect

The read side has existed since 1.5.0 but nothing could raise a connection. Uses
Connection.Connect(ConnectOptions).

Verified: Connected → (none) → Connected, plus three refusals — no --confirm, an ambiguous name
(named all four candidates and changed nothing), and an unknown name (listed what is configured).

• An ambiguous match is refused, never resolved to the first hit.
• connect requires --confirm because it can arm an order-capable surface; disconnect does not,
  because the safe direction should never be the harder one to reach.
• The verdict comes from polling Status to a settled value, and succeeded is reported
  separately from changed, so "already connected" cannot masquerade as work done.

5. The rest of 1.7.0 — dialog, strategy, playbackctl, log, selfcheck

Answer modal and non-modal dialogs; start/stop chart strategies; settle-polled seek + speed +
range; grep a log NT holds open (filtered in-process, since the payload ceiling is small); and prove a
Python tree against its manifest. Each ships with tests.

A few hard-won notes baked into these:

• A seek can succeed and land where there is no data. Writing the clock validates nothing, so an
  out-of-range seek now fails closed instead of truthfully reporting succeeded: true, offset 0.
• A stale object reference watches a corpse — identity is the (type, chart) pair, never the
  pointer; collections are re-queried.
• MethodInfo.Invoke hides the real error behind the content-free "Exception has been thrown by
  the target of an invocation"; InnerException is unwrapped.
• GetMethod binds public-only by default and much of the chart API is internal — members are
  enumerated instead.
• Zero is a value. --speed 0 was rejected as "missing" by a falsy test, which happened to be the
  one value needed to park a running replay.

6. layout — window placement as a hashable file

Capture and re-apply where NT's windows sit, in fractions rather than pixels, keyed by identity
rather than HWND, so it survives a different monitor layout and a restart.

---

Notes for a headless user

restart correctly refuses without --task/--exe, but there's no default task and, from a
session-0 shell (SSH), a bare --exe cannot produce a usable GUI. The recipe that works:

schtasks /Create /TN NtLaunch /TR "powershell.exe -NoProfile -ExecutionPolicy Bypass -File <launcher>" \
         /SC ONCE /ST 00:00 /SD 01/01/2099 /RU <user> /IT /F
nt8bridge restart --task NtLaunch --wait 200

/IT is the whole trick — it reaches the interactive session. Happy to add this to the README if
useful.

Also: NinjaTrader is multi-UI-threaded. Reading Window.Title off the poller thread throws, and
swallowing that turns a --chart filter into a silent mismatch — so titles are read on the owning
dispatcher throughout, with bounded waits.

🤖 Generated with Claude Code

[silentsudo-io]

Follow-up: I said in the description that addIndicator's RefreshAllBars fallback looked suspect. I went and measured it rather than leaving you a vague warning, and it turned out to be a false negative, which is the more dangerous direction.

Adding an indicator to a 2-indicator chart reported:

indicatorsBefore 2  ->  indicatorsAfter 1
stateAfter Configure    succeeded false
verdict: THE CALL RESOLVED BUT THE INDICATOR COUNT WENT 2 -> 1 — treat this as NOT applied

…while the chart a moment later held all three, every one at Realtime. RefreshIndicators tears the collection down and rebuilds it, so a count taken during the rebuild sees a transient that was never a real state. A caller that believes "not applied" retries, and you get duplicate indicators on the chart.

Pushed e526db6: it now settle-polls, the same way applyTemplate and playbackctl --seek do. Same operation now reports indicators 2 -> 3 and it is Realtime.

Also in that commit: the RefreshIndicators failure note used ex.Message, so it printed the content-free "Exception has been thrown by the target of an invocation." It now unwraps InnerException.

365 tests green. Still happy to split this PR up if that's easier to review.

🤖 Generated with Claude Code

[silentsudo-io]

Pushed one more commit to this branch: 98a80c0 — two histget defects found by driving it against a live NT today. Both could quietly damage a replay corpus, so I'd rather they were on the record here than sitting in a fork.

1. It reported downloads it never made. The AddOn answers exists, which is equally true for a file that was already on disk and never fetched, so every pre-existing date came back as downloaded. Two dates already present returned downloaded / count: 1 with nothing written anywhere. Each date is now stat'd (size, mtime_ns) in the real write directory before and after the call; only a file that appeared or changed counts, an absent file is a failure naming the path, and a re-download that produced identical bytes reports unchanged rather than claiming a fetch we can't see.

2. --replay-dir never chose where downloads land. It only built the path for the skip-existing check — download_one sends an instrument and a date and nothing more, and NT8 writes into its own db\replay. The old help text ("db/replay dir") reads as a destination. Requesting a date the corpus didn't hold, with --replay-dir pointed at an empty scratch directory, put the file in the live corpus while the scratch stayed empty. The honest flag is now --check-dir; --replay-dir is refused (exit 2) unless it names the real directory, and the refusal prints that path. Results carry write_dir/check_dir.

Also worth knowing if you touch this area: .nrd mtimes are source-derived, not download time — a file fetched minutes ago carried a two-day-old stamp, which is how I initially mis-concluded I hadn't written anything.

Tests: 10 in test_histget.py, and the new ones are proven able to fail (reverting to the old "trust the reply" classification makes the two load-bearing controls fail). One existing test turned out vacuous — it asserted count == len(downloaded), which holds at zero, while its fake wrote no file; it now writes and asserts a real outcome. Full suite 372 passed, 6 skipped. Verified live: forced re-download of a held date now reports unchanged/count 0, and the foreign --replay-dir exits 2.

Happy to split this into its own PR if you'd prefer it separate from the chart-cell work.

[silentsudo-io]

Two commits added since the initial review request — flagging them rather than letting them appear silently.

da68705 — a new order verb family (place / cancel / change / status / list / api).

This is the highest-risk thing in the AddOn, so it is built refusal-first:

• Simulation accounts only. The gate is an allowlist — Account.Provider == Provider.Simulator — not a denylist. That turned out to matter: real broker accounts on my box report Provider31, an unnamed enum value, which a != Live check would have passed straight through. Proven against two funded accounts.
• No escalation flag exists. Reaching a live account requires editing and recompiling the AddOn. That is deliberate, not an oversight.
• confirm=true is mandatory for every mutating action, and account / instrument / side / type are never inferred.
• Outcomes are settle-polled, never judged by the call — consistent with the apply-template and addIndicator fixes elsewhere in this PR. A still-moving order returns settled:false with its state rather than an error, because a false negative makes a caller retry, and a retried placement is a duplicate order.
• order --api dumps the live Account/Order surface (unfiltered) so the contract is read off the platform rather than from docs.

Driven end to end on Sim101: place → Working, change → reprice with quantity preserved, status, cancel → Cancelled. 34 new tests, every one asserting a refusal.

3e14423 — chartseries sends Value/Value2 independently of --bars-type.

They were nested under if bars_type:, so a call naming no type sent no values, and there was no way to set values on an already-selected bars type. This opens the two-pass path (switch type, then stamp values). It does not by itself defeat NT re-applying a custom bars type's own defaults — that remains open — but the client is no longer the blocker.

Suite: 406 passed, 6 skipped. Happy to split either commit into its own PR if that is easier to review.

[eman007]

Heads-up that main moved under this branch: aeca908, released as 1.5.1. It fixes #6 (reported
by @Quantrosoft) — configure resolved its write targets once before the key loop, so after
Strategy swapped the StrategyTemplate every later key wrote to a detached object, reported
"status": "set", echoed its value back, and left the tab on its old data series. Same shape as
several things in this PR: the call resolved, and that was mistaken for the work having happened.

I tested the merge locally so you are not guessing at it:

addon/NT8BridgeServer.cs   Auto-merging ✓  — no conflict
README.md                  Auto-merging ✓  — no conflict
CHANGELOG.md               CONFLICT
pyproject.toml             CONFLICT

The C# merges clean, +4,387 lines and all — you did not touch RunConfigure, so the two diffs
do not overlap. Both conflicts are bookkeeping:

• pyproject.toml — keep your 1.7.0, drop the 1.5.1.
• CHANGELOG.md — the new ## [1.5.1] section slots in between your [1.6.0] and [1.5.0].

Two notes in case they save you a step. configure now applies Strategy first regardless of
map order, so anything in this branch that configures a tab no longer depends on key ordering. And
each set carries a new nowReads field, read off a freshly resolved chain rather than off the
object just written to — a read-back from the object you wrote to passes cleanly in exactly that
bug. It is a value and never a verdict, since setters legitimately transform (BarsPeriod "77077:120:1" reads back as "Wave 120").

No need to rebase on my account unless you would rather keep the branch current — the review is not
blocked on it.

[eman007]

Read the whole diff — AddOn C#, every new Python module, and the MCP server. The AddOn compiles
clean offline ([SUCCESS], only the expected CS0436 duplicate-type warnings against the deployed
Custom.dll), so nothing below is about build health.

The evidence discipline in here is the best thing about the PR, and it is not a small thing: the
RefreshAllBars regression found by laddering each step, the addIndicator false negative caught
because a count taken mid-rebuild is not a state, the Provider31 discovery that turned the order
gate from a denylist into an allowlist. Several of the findings below are cases where that same
standard was not applied to the new code itself.

I am requesting changes on three of them. The rest are notes.

---

Blocking

1. The risk gate blocks cancel and change — and its own text says it doesn't

NT8BridgeServer.cs:5537

SentinelGovernorRefusal lives in OrderGate, and OrderGate is called by all three mutating
verbs: place (5712), cancel (5778), change (5825).

The refusal it emits says:

Flatten and exit paths are unaffected; this refusal applies to NEW positions only.

That is false for two of the three call sites. Concretely: an account trips its daily-loss halt
while a stop-limit or an unfilled entry is still working. order --action cancel --confirm now
returns RISKLOCKED and the order stays live — at exactly the moment you most want it gone.
change (pulling a stop in) is blocked the same way.

The reasoning in the comment block above it is right — the container is a participant, not a
perimeter — but the conclusion only applies to taking on new exposure. Cancelling a resting order
is risk-reducing. The consult belongs in RunOrderPlace, not in the shared gate.

2. run_range's corpus-recorder refusal fails OPEN

fleet.py:388

for chart in (call("chart") or {}).get("charts", []) or []:

call() discards the return code and parses stdout. On timeout the CLI prints
{"command":"chart","status":"timeout","ok":false} — a truthy dict with no charts key — so
live == [], undeclared == [], and the bake starts. The unparseable-output fallback
({"_raw", "_rc"}) does the same. Every failure mode of the probe reads as "nothing attached."

So: NT restores a workspace with a corpus recorder at Realtime, the probe happens to time out, and
the replay writes replayed rows into the live corpus — the precise outcome this refusal exists to
prevent. The result payload then reports "recorders": [] as though it were measured.

fleet.py's own header states the rule this breaks:

a box that could not be reached is UNKNOWN, never "fine"

A probe that did not answer needs to be its own refusal, distinct from a probe that answered "none".

3. --verify-utc-offset defaults to 0.0, so the witness fails every correct seek

cli.py:1401

seekwitness.verify computes abs((got - timedelta(hours=utc_offset_h)) - tgt), where got is a
UTC bar stamp and tgt is the transport's Est target. With the default offset of 0 the
drift is a constant ~300 min against tolerance_min=90.

The witness is on by default (--no-verify-bars is the opt-out, cli.py:847/887), so a plain
playbackctl --seek '2025-12-30T12:00' --speed 5 that landed perfectly reports
verdict: DID NOT REPOSITION, prints "⛔ THE CLOCK MOVED AND THE TAPE DID NOT", and exits 2.

That is the same class of misverdict seekwitness was written to eliminate, arriving by the
opposite sign. The default should be the box's own Est→UTC offset, not 0.

---

Should fix

• sentinel_mcp/tools.py:169/181/241 — three MCP tools send arguments the CLI does not accept.
  Verified by running the parser: flatten --confirm → unrecognized arguments: --confirm (exit 2);
  chart --indicators → unrecognized arguments: --indicators; fleet with no --verb → the following arguments are required: --verb, and verb is not in nt_fleet's schema, so a caller
  cannot supply it. nt_flatten and nt_fleet can never succeed. Given the README's argument that
  shell=False removes a class of quoting bug, these are worth a test that asserts each tool's argv
  against the real parser — the bug class moved rather than disappeared.

• NT8BridgeServer.cs:2610 — dataWindow reports succeeded: true while its own verdict says
  the values did not stick. bool wOk = wAfter != null && !wRejected; ignores wChanged, so a
  write NT accepted by reflection but silently discarded returns succeeded: true next to
  "verdict": "…the values did not stick", and the CLI exits 0. A human reading summary sees
  failure, a script gating on the exit code sees success. Same principle as the section-3 rule in
  your description ("a rejected field fails the whole call") — this is the unchanged case rather
  than the rejected one.

• cli.py:835 — the park-first fix only applies when --speed is also given.
  actions.append("park") is nested inside if args.speed is not None:, so a bare --seek against
  a transport left at 5x skips the park and hits the documented failure: the settle poll burns the
  full timeout and reports the clock was still moving. The docstring's justification — deterministic
  regardless of the state the box was left in — argues for making it unconditional for seek.

• cli.py:1605 — runrange/fleet/corpus/versions exit 0 unless explicitly refused.
  A runrange that logged "no clock reading; abandoning" after zero progress exits 0; so does a
  fleet where every host was unreachable and a versions where every box read STALE. builds
  (~1576) already does this correctly with 2/3.

• staging.py:52 — NT8 is hardcoded to C:/Users/Administrator/…, including on the local
  path. On a box where the user is not Administrator — the normal case for this repo — survey
  returns empty and stage refuses with "requested day(s) exist on neither side" while the file is
  sitting in the real db\replay. The rest of the package goes through ntio.nt8_root(), which is
  NT8_DIR-overridable. The fleet.py constants have the same issue but are remote-only.

Smaller

• NT8BridgeServer.cs:5914 — order --action status passes settleSeconds = 0, so the settle loop
  never executes and settled is always false, including on a filled order. That's the field a
  caller polls instead of re-submitting.
• fleet.py:60 — retired=false in fleet.conf excludes the host: values are raw strings and
  callers test truthiness, so false/no/0 all read as retired. The omission is invisible,
  because the report only lists hosts it saw.
• fleet.py:335 — the refusal branch returns from/to and the success branch returns
  start/end, so a wrapper reading out["start"] raises KeyError on exactly the refusal it
  handles. Also, the opening call("playbackctl --seek …") is unchecked — a bake whose first seek
  was refused still runs to completion and reports refused: false, started: true.
• fleet.py:225 — builds --reference documents a DLL path, but local_digest returns None
  unless it is a directory, so the documented value makes referenceDigest silently null.
• s3.json at repo root looks like a stray — a captured layout output from your box.

---

On scope

Taking you up on the offer to split, which you have made three times.

The chart work — --api, --apply-template, --data-window — is the strongest part of this and is
close to mergeable on its own. connections --connect/--disconnect and the
dialog/strategy/playbackctl/log/layout set are a reasonable second piece. order wants
finding 1 fixed first, and I'd like it to land by itself so it gets reviewed on its own terms.

fleet/corpus/versions/runrange/stage/seekwitness and sentinel_mcp/ are a different
question, and it is not a code-quality one. They are orchestration for a specific multi-box Sentinel
deployment, and sentinel_mcp/ is an MCP surface for a suite that is not part of this project.
I'd rather not take those into this repo — not because they are bad (the seekwitness finding that
NowEst is a displayed clock rather than a data cursor is genuinely valuable and I want that
written down somewhere), but because this repo's scope is "drive one NinjaTrader from a CLI," and a
fleet orchestrator with a hardcoded Administrator path and an MCP server are both a step outside it.
They would fit better as a separate repo that depends on nt8bridge. Happy to link it from the
README.

On that note: the AddOn's file header still says

⚠ NO SENTINEL REFERENCES IN THIS FILE, BY DESIGN. It ships in an open-source repo.

while the file now names Sentinel 35 times. The reflection-based consult itself is done carefully —
no hard reference, compiles and no-ops where the suite is absent, logs RISK CONSULT INERT once —
so the mechanism is fine. The standing rule the header states is what needs updating, or restoring.

Also worth knowing: main has moved to 1.5.1 (see my earlier note) — NT8BridgeServer.cs still
auto-merges, only CHANGELOG.md and pyproject.toml conflict.